Is there a possibility to write an event to splunk index source type through SPL?

[shahid285]

I have an requirement where the user would like to store the data to a source type of an index. and would be modifying the same data, on repeated intervals.
I would like to know, whether , there is a possibility to write an event to splunk index's source type through SPL.
I am restricted to use any kind of SDK to the max to achieve this, hence expecting the solution through this.

Thanks in advance,

Mohammed Shahid Nawaz

[nickhills]

The collect command will let you do this:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Collect

[shahid285]

Hi @nickhills
Thank you for your input, much appreciated! 🙂
I tried to follow the splunk doc, but i was unable to either find a proper example to push the data to the index , nor, was i able to construct a working query with collect command.

I have ended up with this query, hope you may help me here.

| eval _raw = "{\"avgPercentage\":\"70\", \"MaxPercentage\":\"90\"}" | table _raw| collect index="_internal" sourcetype="_internal" run_in_preview=true

also i tried like the below one too.

| makeresults | eval tp = "{\"maxPercentage\":\"70\", \"percentage\":\"90\"}" | return $tp | collect index="xxxx-aci" file=$timestamp$.stash sourcetype="xxxxxx" run_in_preview=true

I have created a new source type for my existing index to store those above percentage values.
None of this is showing either any error or when searched with the index and sourcetype any event results

I hope you can help me in correcting my query.

Thanks again!
Mohammed Shahid Nawaz

[shahid285]

Guys, Still waiting for update on the solution, need it badly. Please help 🙂

[somesoni2]

You can write to Splunk via search command collect via SPL.
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Collect

However, you won't be able to modify the data (data once indexed can't be modified). You may want to use a lookup table OR kv-store (preferred) for your requirement.

[shahid285]

Hi @somesoni2,
Thank you for your input, much appreciated! 🙂
I tried to follow the splunk doc, but i was unable to either find a proper example to push the data to the index , nor, was i able to construct a working query with collect command.

I have ended up with this query, hope you may help me here.

| eval _raw = "{\"avgPercentage\":\"70\", \"MaxPercentage\":\"90\"}" | table _raw| collect index="_internal" sourcetype="_internal" run_in_preview=true

I have created a new source type for my existing index to store those above percentage values.

I hope you can help me in correcting my query.

Thanks again!
Mohammed Shahid Nawaz